High
CVE-2026-44741
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 423
Reset filters
High
CVE-2026-44177
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
Critical
CVE-2018-25357
Dolibarr ERP CRM contains a remote code evaluation vulnerability
Medium
CVE-2026-8245
Concrete CMS is Vulnerable to Reflected XSS in Legacy Pagination
High
CVE-2026-8197
Concrete CMS is vulnerable to Stored XSS via OAuth integration name
Low
CVE-2026-46637
Twig: HTML-output filters in twig/* extras incorrectly declared `is_safe => ['all']`
High
CVE-2026-35671
phpMyFAQ: IDOR Account Takeover
High
CVE-2026-31069
BillaBear is Vulnerable to SQL Injection in the EventRepository
Medium
CVE-2026-46337
AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`
High
CVE-2026-45793
Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs
Medium
CVE-2026-45731
AVideo: Authenticated Arbitrary File Read in view/update.php
High
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Medium
CVE-2026-45139
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Medium
CVE-2026-45138
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
High
CVE-2026-45578
AVideo: OS command injection in on_publish.php execAsync via unescaped m3u8 URL
Medium
CVE-2026-23695
Cockpit CMS: Stored cross-site scripting vulnerability in the Set field type's Display template option
High
CVE-2026-39850
Yii 2: Local file inclusion via view parameter name collision
Medium
CVE-2026-27892
FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download
High
CVE-2026-42552
Flight vulnerable to sensitive information disclosure via default error handler
High
CVE-2026-42550
Flight vulnerable to SQL Injection via unvalidated identifiers in SimplePdo::insert / update / delete
Medium
CVE-2026-42549
Flight has path traversal in `make:controller` CLI that creates arbitrary directories outside project root
Critical
CVE-2026-46364
phpMyFAQ has unauthenticated SQL injection via User-Agent header in BuiltinCaptcha
High
CVE-2026-46359
phpMyFAQ has SQL Injection in CurrentUser::setTokenData through unescaped OAuth token fields
Medium
CVE-2026-46361
phpMyFAQ has stored XSS via | raw Filter in search.twig — html_entity_decode(strip_tags()) Bypass in Search Result Rendering
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.